CVE-2004-0842

published 2004-12-23

CVE-2004-0842: Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory…

Priority P3 39 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

Affected

6 ranges

Vendor	Product	Version range	Fixed in
avaya	modular_messaging_message_storage_server	—	—
avaya	modular_messaging_message_storage_server	—	—
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

other @;/*↗

other ;@/*↗

command d = window.open().document; d.write("x"); d.body.innerHTML = "@;/*";↗

• → Look for HTML responses containing unterminated CSS comment sequences (e.g., '@;/*' or ';@/*') inside or following a STYLE tag, which are the trigger strings for this heap corruption. ↗
• → Monitor for JavaScript-driven DOM manipulation that writes malformed CSS strings (e.g., '@;/*') into innerHTML, a known delivery vector for this vulnerability. ↗
• → Target is Internet Explorer 6.0 SP1 and earlier (including 5.0.1); flag IE User-Agent strings for these versions when accessing pages containing the malformed CSS trigger strings. ↗

• · The exact vulnerable versions span IE 5.0.1 through IE 6.0 SP1; exploitation on versions outside this range is unconfirmed ('and possibly other versions'). ↗
• · The root cause may be a missing comment terminator causing an invalid length calculation that triggers a large memory copy — detection rules should account for both '@;/*' and ';@/*' variant orderings. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.